I disagree with the Canada ban, but I'm not sure this video sends the message they think it does. To many people on HN no doubt this is a pretty simple guide to follow, but IMHO Flipper Zero still makes this MUCH easier for the average public.
I find that a fairly cheeky (and entertaining) response.
I wouldn't say that Flipper Zero is something that an "average Joe" would use, although it does make this kind of thing easier.
I have known a few car thieves, in my day (long story), and not one of them would have had any problem, doing what they describe.
In fact, I'll bet that there are already illegal black boxes that do exactly that. People who steal cars, aren't going to let things like commercial product bans stop them.
I wonder if you could use detector-radio type kit as the electronics for an even bigger flex. i.e. a corroded nickel strip for the diode and some aluminium foil for the cap.
Mind you that would maybe hardly working but it only has to do so once :)
I too disagree with the Canada ban, however I think the regulators are more concerned with how easy this can be done with a flipper zero. The moment you took out a soldering iron to build an antenna filter you've increased the complexity to the point where the regulators are no longer concerned. Yes this is still very dumb imho.
Most likely, it will work. You may need a few tries in case the connections aren't super tight. And it may stop working rather quickly due to corrosion of the contact surfaces.
However, in particular in headphone cables, the wires are often isolated using coating, which is hard to remove without applying q significant amount of heat.
Bans of Flipper Zero are ridiculous but Flipper should have run this by a "lay person" (sales, PR, marketing, an intern). Stripping a wire, showing a schematic with a diode and resistor, winding wires, soldering iron, etc just further proves the point of the regulators.
Meanwhile in the beginning of the video they show decoding the signal with the pocket-sized Flipper Zero with the push of a button in a few seconds. Easy, portable, easily concealable.
Ordering a $20 SDR from Amazon, plugging it in (even an Android phone), and clicking/tapping around in one of the many SDR GUI programs available would have demonstrated:
1) This functionality isn't limited to the Flipper Zero and has been around for years.
2) It's still "plug and play" and relatively low skill level.
3) It's actually cheaper and uses a device everyone already has in their pocket.
They shot themselves in the foot with this and only gave regulators more ammunition to call for bans.
They seem to have combined a sales/marketing video for Flipper Zero with a PR video for regulators.
I follow you, but the use case they mentioned to propose the ban is stealing cars. I'd figure a car theft ring is sufficiently motivated to figure out how to solder.
A car theft ring sophisticated enough to solder is going to realize several things:
1) Flipper Zero = almost no effort and instant.
2) Cheap and plentiful USB SDR = slightly more effort, longer range, higher signal integrity, faster, works with anything that can do host USB.
3) Using a headphone jack and requiring some amount of electronics expertise for what is in the end going to be a very short range and cumbersome tool that requires a 3.5mm jack that isn't even present on many/most modern devices is practically a non-starter.
This is basically a sales and marketing video for car theft rings.
To be clear, modern society as we define it functions largely through "security through obscurity", considering that anybody with a sledgehammer can break into your property.
attack complexity is weird and often flawed,
e.g. you think attackers need advanced hardware, but then someone does it woth a MCDonalds Toy. Same for software stuff.
You can steal many Kia and Hyundai cars on the road with a USB cable[0] that doesn't even involve electronics. It just so happens the physical shape of the USB plug fits well over the ignition tumbler. As the article points out many cars will have a USB A cable in them already and at that point all you need is a rock to break a window (or just open an unlocked door).
Many jurisdictions have laws against carrying theft or burglary tools[1] and needless to say walking around with a USB cable is innocuous enough to be hard to apply these existing laws to. In many instances these are only used to apply an additional charge to suspects that have already been caught for theft or burglary.
I'm responding to the people saying this is still out of reach for most people due to requiring soldering. Less than 30 seconds of searching shows that I can buy an RTL-SDR USB dongle and kit for about $40 which can also analyze the 433Mhz band and more. This ban is ridiculous on its face.
Absolutely agree the ban is ridiculous, but lets not now humbly hide the fact that FZ makes this way easier than the workflow shown in the video. Even ignoring the antenna construction you still need to record the data and post process it using a laptop and 3rd party software.
An Android smart phone and SDR dongle with antenna will fit in your pocket easily. No construction required. Apps already on the Android app store.
Here's the thing about easier; A determined car thief probably has access to purpose built devices and given the financial incentive will probably put more time into solving this "problem" than an amateur. I would argue that knowing this attack is possible is more than half way there because it opens up avenues of research.
It arguably would have been smarter for FZ to show a video using an SDR dongle/android phone than hobbyist antenna construction if they were trying to drive home the point of simplicity.
Advocating on behalf of the devil: ease of access for determined attackers is not the concern. It's more the undetermined attackers they are worrying about enabling. (again I do not agree with law as the solution to this)
That's true, and I agree to a point. But, I think they wanted to nail the "You don't even need a dongle" part of it. Because none of this is enabled by Flipper or a dongle. A handful of components you can get from a broken radio suffice. There's nothing magical or beyond reach making this attack possible. You don't need custom chips, or a long logistics pipeline to enable it. You don't even need a company to produce anything specific. The from-scratch demo they posted hammers home that working from nothing you can do this in an afternoon with tools you can get at Walmart and it's well within a high school student's abilities.
FYI, banning things in Canada is not easy when they are not also banned in the US. The economies are so intermingled that whenever this happens it follows a pattern: for a few years the people guarding the border will zealously enforce the rule. Then they will forget about it and go back to business as usual. There is just too much to inspect. The guards are too busy dealing with all the guns coming north to worry about electronic gadgets. That is IF they are even there to inspect. The amount of private plane/boat traffic across the border is immense, especially during the summer. Canada is also notorious for not enforcing local bans. Flippers will probably be available on Ebay.ca within a year, just like those epic laser "pointers" that are illegal to sell in Canada but widely available in the US.
I lived in California for 5 years and didn't see or hear a gunshot either outside of those exclusions. Same living in Canada for 20+ years. It's not a useful measure to be honest.
We were just having a good laugh yesterday about antique firearms being extempt from licensing in some US states and people doing Civil War reeancments. The truth is guns are part of your culture.
Outside of the context of the ban, this is a bit of a self-own imho. You indeed do not need a flipper zero to learn about and play with RF. In fact, you learn more without one, as demonstrated in the video.
I mean, go off Dudley Doright, but there's not much that the Flipper Zero does that can't be done with off-the-shelf microcontroller hardware that is getting better and better every year. There _will_ be a replacement.
The "automakers have known for 20 years not to design wireless entry systems that this device can hack" argument is much stronger than the "you can't ban us! we're just doing physics!" argument in the specifically linked tweet.
I do not agree with the ban, but I would like to provide some context as a Flipper Zero (F0) owner and someone who is in several F0 communities and have used a few different firmware besides the official one.
There are a lot of younger kids in the community who have the F0 and are just looking to cause havoc. Joining these communities and looking for the jamming files and want to open every Tesla charging port they come across. Or when the device gained the Bluetooth spamming capability, people wanted to use that everywhere.
Normally these people are promptly dismissed or kicked from the server, but it is a constant influx of these people.
There are plenty of people who use the F0 properly either for work and just learning about signals, or a multitool making their day a little easier. And plenty of new features are coming out every few weeks from the amazing unofficial firmware developers.
I think the question, instead of banning devices, should be to make sure we are teaching people strong morals and that there are possible consequences to their actions.
Will this stop someone from making a device that has the same and more capabilities but doesn't look like a Flipper Zero much in the way most HAM radio manufacturers design the radios to be super easy to unlock some/all bands? e.g. a smart phone USB add-on that does all FZ's tricks and more after you move a jumper.
It just shows that when you put people who don't have subject matter experience in positions that require said subject matter experience, they do stupid things based on what other "experienced" people say, or what is politically expedient at the time for votes or otherwise.
François-Philippe Champagne is a lawyer, who was formerly the minister of foreign affairs, the minister of infrastructure and communities, and minister of international trade.
Why do you have someone who held positions in industries or areas not related to technology being put in a position to make these kinds of decisions?
The government should be at the very least:
- Cracking down on gang activity at sea ports where stolen vehicles are put into containers and sent off to be sold in foreign countries.
- Forcing vehicle manufacturers (at their cost) to recall their older vehicles and retrofit more modern keyfobs with new security (for model years within the last 10-15 years) with non-compliance resulting in being unable to sell their new vehicles in the country.
- Increasing the severity of punishment for anybody who has stolen a vehicle, with an even more harsh penalty if they're found to be stealing vehicles with technology designed with the capability to capture and replay these keyfob signals.
It's a weak government with no idea on what they're doing and the Flipper Zero ban was a misguided, uneducated decision that was done to gather more votes instead of actually dealing with the problem directly.
Put ministers with actual industry/tech experience into these positions. Canada is slowly failing under it's current government, and I'm confident any other mainstream running party won't just bring more of the same ineptitude.
42 comments
[ 3.4 ms ] story [ 95.6 ms ] threadCheck out how to receive and decode 433MHz radio signal just with a PC sound card."
I wouldn't say that Flipper Zero is something that an "average Joe" would use, although it does make this kind of thing easier.
I have known a few car thieves, in my day (long story), and not one of them would have had any problem, doing what they describe.
In fact, I'll bet that there are already illegal black boxes that do exactly that. People who steal cars, aren't going to let things like commercial product bans stop them.
FlipperZero: Our Response to the Canadian Government | https://news.ycombinator.com/item?id=39759530
Mind you that would maybe hardly working but it only has to do so once :)
However, in particular in headphone cables, the wires are often isolated using coating, which is hard to remove without applying q significant amount of heat.
Banning one of the many specific parts to do an illegal thing rarely ever makes the illegal thing harder to do.
Bans of Flipper Zero are ridiculous but Flipper should have run this by a "lay person" (sales, PR, marketing, an intern). Stripping a wire, showing a schematic with a diode and resistor, winding wires, soldering iron, etc just further proves the point of the regulators.
Meanwhile in the beginning of the video they show decoding the signal with the pocket-sized Flipper Zero with the push of a button in a few seconds. Easy, portable, easily concealable.
Ordering a $20 SDR from Amazon, plugging it in (even an Android phone), and clicking/tapping around in one of the many SDR GUI programs available would have demonstrated:
1) This functionality isn't limited to the Flipper Zero and has been around for years.
2) It's still "plug and play" and relatively low skill level.
3) It's actually cheaper and uses a device everyone already has in their pocket.
They shot themselves in the foot with this and only gave regulators more ammunition to call for bans.
They seem to have combined a sales/marketing video for Flipper Zero with a PR video for regulators.
Frankly it's incredibly stupid on their part.
1) Flipper Zero = almost no effort and instant.
2) Cheap and plentiful USB SDR = slightly more effort, longer range, higher signal integrity, faster, works with anything that can do host USB.
3) Using a headphone jack and requiring some amount of electronics expertise for what is in the end going to be a very short range and cumbersome tool that requires a 3.5mm jack that isn't even present on many/most modern devices is practically a non-starter.
This is basically a sales and marketing video for car theft rings.
But Canada is fighting a lost cause to strengthen "security through obscurity".
Many jurisdictions have laws against carrying theft or burglary tools[1] and needless to say walking around with a USB cable is innocuous enough to be hard to apply these existing laws to. In many instances these are only used to apply an additional charge to suspects that have already been caught for theft or burglary.
[0] - https://www.thedrive.com/news/how-thieves-are-stealing-hyund...
[1] - http://www.leg.state.fl.us/Statutes/index.cfm?App_mode=Displ...
Here's the thing about easier; A determined car thief probably has access to purpose built devices and given the financial incentive will probably put more time into solving this "problem" than an amateur. I would argue that knowing this attack is possible is more than half way there because it opens up avenues of research.
Advocating on behalf of the devil: ease of access for determined attackers is not the concern. It's more the undetermined attackers they are worrying about enabling. (again I do not agree with law as the solution to this)
[+] except at the range, or while hunting when I or my buddies pulled the trigger.
I’m in a rural area though, so it’s not, you know, people killing each other. It’s hunting/practicing/plinking.
TBH, the only vehicle-related thing I've seen a Flipper Zero do is to open the Tesla charging port door. Novel, but not exactly theft.
I know this has probably been said to death, but it really is a "jack of all trades, master of none"
Canada walks it back here: https://news.ycombinator.com/item?id=39778185
There are a lot of younger kids in the community who have the F0 and are just looking to cause havoc. Joining these communities and looking for the jamming files and want to open every Tesla charging port they come across. Or when the device gained the Bluetooth spamming capability, people wanted to use that everywhere.
Normally these people are promptly dismissed or kicked from the server, but it is a constant influx of these people.
There are plenty of people who use the F0 properly either for work and just learning about signals, or a multitool making their day a little easier. And plenty of new features are coming out every few weeks from the amazing unofficial firmware developers.
I think the question, instead of banning devices, should be to make sure we are teaching people strong morals and that there are possible consequences to their actions.
François-Philippe Champagne is a lawyer, who was formerly the minister of foreign affairs, the minister of infrastructure and communities, and minister of international trade.
Why do you have someone who held positions in industries or areas not related to technology being put in a position to make these kinds of decisions?
The government should be at the very least:
- Cracking down on gang activity at sea ports where stolen vehicles are put into containers and sent off to be sold in foreign countries.
- Forcing vehicle manufacturers (at their cost) to recall their older vehicles and retrofit more modern keyfobs with new security (for model years within the last 10-15 years) with non-compliance resulting in being unable to sell their new vehicles in the country.
- Increasing the severity of punishment for anybody who has stolen a vehicle, with an even more harsh penalty if they're found to be stealing vehicles with technology designed with the capability to capture and replay these keyfob signals.
It's a weak government with no idea on what they're doing and the Flipper Zero ban was a misguided, uneducated decision that was done to gather more votes instead of actually dealing with the problem directly.
Put ministers with actual industry/tech experience into these positions. Canada is slowly failing under it's current government, and I'm confident any other mainstream running party won't just bring more of the same ineptitude.